The hidden failure
A green test can still ship incomplete data.
Our controlled API moved from one flat response to cursor pagination. The shallow migration looked healthy, returned HTTP 200 and silently dropped three records.
The product story
Documentation says what changed. Forward proves the release changed with it.
Maintainers should not have to choose between slow manual migrations and unchecked agent autonomy. Forward gives an agent room to reason and repair while evidence and release authority stay independent.
The Forward promise
Turn a change notice into a release you can defend.
Forward connects the source, the repair, the independent checks and the approved artifact so every claim has an inspectable proof surface.
Understand the changeProve the repairControl the release
Three of five records disappeared in the naive first-page implementation.
The repaired artifact follows every cursor and returns the complete contract.
Plan through govern is connected to a public proof surface.
Cold-start recovery retries only timeouts and stops after the second attempt.
Who this is for
Maintainers adopting breaking API, SDK or platform changes where familiar tests can miss new completeness requirements.
What generalises
Pin the source, derive checks with Duo, constrain the diff, verify independently, stage one immutable artifact and require exact approval.
How Forward works
From breaking-change notice to governed release.
A single traceable journey replaces disconnected research, coding, testing and deployment hand-offs.
State the intent
A maintainer opens a bounded migration issue.
Duo reasons
Duo reads the source, derives checks and repairs only allowed files.
CI proves
Independent tests, security scans and packaging bind the exact candidate.
Cloud stages
The immutable image is exercised on Google Cloud.
Human decides
Production requires approval of the exact SHA and image digest.
The blind spot
A shallow client passed its original single-page test while silently losing paginated records.
The Forward result
Duo corrected the bounded target; a separate oracle proved all pages, repeated-cursor rejection and duplicate-ID rejection.
The trust model
Useful autonomy, deliberately separated authority.
Forward is not another chatbot wrapper. Each actor has one clear job, and no actor can mark its own work safe for production.
Control boundary
No self-approval
Reasoning, verification and release remain separate.
Reason
GitLab Duo
Understands the source, creates checks and repairs bounded files.
Prove
Trusted CI + Codex
Independently tests, scans, packages and records evidence.
Decide
Human maintainer
Approves one exact SHA and image digest for production.
Open proof
The product story is backed by inspectable work.
Native Duo session pages can require GitLab access. Every runtime claim is therefore paired with a public issue, MR, pipeline or preserved output that judges can inspect without joining the private flow. Authenticated sessions, publicly corroborated.
Source became executable checks
Duo retrieved the pinned migration contract, attributed three requirements and generated the checks that exposed the naive client.
Open public research receiptBounded candidate and runtime wiring
Duo changed allowed target files on one fixed-base branch and reused MR !1.
Inspect public MR !1Unsupported scope failed closed
An OAuth request targeting a forbidden file produced no edit, branch or merge request.
Open public rejection receiptCloud failure drove two bounded repairs
The first canary still failed; Duo used that evidence for a narrower timeout repair that passed a confirmed cold-path replay.
Open public reliability receiptGitLab lifecycle
All nine official stages, with evidence.
Each row names the responsible actor and links to a public proof surface. “Attention” is not presented as a pass.
Plan
GitLab DuoRead a commit-pinned migration source and derived three traceable requirements.
verifiedResearch evidenceCreate
GitLab DuoChanged only the allowed adapter and runtime file, then made two bounded reliability repairs on the same auditable MR.
verifiedMerge request !1Verify
Trusted CIRan generated checks, baseline tests, timeout/retry checks and a separate five-scenario oracle.
verifiedCandidate jobPackage
Trusted CIBuilt the exact candidate in public CI and Cloud Build; the staging release is pinned by digest.
verifiedImage jobSecure
Trusted CIPassed dependency, static-analysis and secret scans in the current nine-job pipeline.
verifiedSecurity pipelineRelease
Human + CIThe maintainer approved the exact repaired SHA and digest; production now serves that same artifact.
verifiedProduction endpointConfigure
Codex + TerraformProvisioned least-privilege identities, keyless WIF and bounded Cloud Run services.
verifiedDeployment codeMonitor
Trusted CIAfter both services scaled to zero, the first repaired staging request succeeded with all five records.
verifiedAcceptance reportGovern
Human + policyBound promotion to an exact candidate and image, with explicit production approval and staging-only recovery.
verifiedRelease evidenceProof, not theatre
A small migration with production-grade controls.
Source-derived contract
Upgrade a controlled records client from a flat v1 response to a cursor-paginated v2 contract without losing records or weakening failure handling.
- Follow every next_cursor until the fixture returns null.
- Reject a repeated cursor instead of looping indefinitely.
- Reject duplicate record IDs according to the fixture-owned contract.
Immutable release identity
Candidate
fd454b2dfd1e68f216a5c96be47394c09ac9c320
Image
sha256:b1d6dc490559a9d7e9601577d5f73b74e26f4ae378d4da98ed32df67d9b95d1a
Controlled fixture. The records API and migration announcement are synthetic project assets, not a vendor announcement.